Description
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.
Published: 2026-10-19
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Patch Immediately
AI Analysis

Impact

The flaw allows a local attacker to gain elevated privileges because of improper privilege management. The resulting privilege escalation can compromise confidentiality, integrity, and availability of the host, potentially giving an attacker full control over the affected system. The weakness is an example of the type identified in CWE‑269.

Affected Systems

IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 are affected. The recommended fixes are the iFix series updates: 6.3.0.7.iFix033 (includes 6.3.0.7.iFix030) for the 6.3 line and 6.4.0.6.iFix025 (includes 6.4.0.6.iFix021) for the 6.4 line, all available via IBM Fix Central.

Risk and Exploitability

The CVSS base score of 8.4 indicates a high severity potential. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, but the impact remains significant because a local attacker who can log in or execute code can exploit the privilege flaw. Exploitation requires local access but can lead to full system compromise.

Generated by OpenCVE AI on October 20, 2026 at 06:04 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading ProductVersionRemediation/Fix/InstructionsIBM Sterling Connect:Direct for Unix6.3.0.0 - 6.3.0.7.iFix029Apply 6.3.0.7.iFix030, included in 6.3.0.7.iFix033 available on  Fix Central https://www.ibm.com/support/fixcentral/swg/selectFixes .IBM Sterling Connect:Direct for Unix6.4.0.0 - 6.4.0.6.iFix020Apply 6.4.0.6.iFix021, included in 6.4.0.6.iFix025 available on Fix Central https://www.ibm.com/support/fixcentral/swg/selectFixes .

OpenCVE Recommended Actions

  • Apply IBM Sterling Connect Direct for Unix iFix033 for 6.3.x versions, which includes the necessary privilege management fix. Apply iFix025 for 6.4.x versions, which incorporates the same fix. Verify that the chosen iFix is compatible with the running instance and redeploy the service or reboot as instructed by IBM.
  • Re‑deploy the updated iFix packages according to IBM’s guidance and ensure the service restarts cleanly. During restart, confirm that the privilege handling logic has re‑initialized correctly.
  • After the patch, test local account privileges to confirm that the privilege escalation pathway has been blocked and that user accounts behave according to intended authorization settings.

Generated by OpenCVE AI on October 20, 2026 at 06:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Description IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.
Title IBM Sterling Connect:Direct for Unix Improper Privilege Management
First Time appeared Ibm
Ibm sterling Connect Direct
Weaknesses CWE-269
CPEs cpe:2.3:a:ibm:sterling_connect_direct:6.3.0.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct:6.3.0.7:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct:6.4.0.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct:6.4.0.6:*:*:*:*:unix:*:*
Vendors & Products Ibm
Ibm sterling Connect Direct
References
Metrics cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Ibm Sterling Connect Direct
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-19T23:56:21.017Z

Reserved: 2026-10-05T13:57:37.099Z

Link: CVE-2026-105453

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T00:17:23.400

Modified: 2026-10-20T15:03:59.857

Link: CVE-2026-105453

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:15:10Z

Weaknesses
  • CWE-269

    Improper Privilege Management